Adversarial Vulnerability. Adversarial examples [1]}, [2]} have attracted significant attention due to vulnerability of neural networks in safety-critical scenarios. Although initially found as \(\ell _p\) -bounded attacks [2]}, [4]}, several beyond \(\ell _p\)  adversaries have been proposed that degrade performance of deep models. They include semantic perturbations, such as rotation and translation [5]}, [6]}, [7]}, color manipulation [8]}, renderer-based lightness and geometry transformation [9]}, parametric attribute manipulation [10]}, 3d scene parameters such as camera pose, sun position, global translation, rotation [11]}. These threats present a serious obstacle for model deployment in safety-critical real-world applications.
